Malware Detection via Entity Grouping and Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection systems struggle to identify advanced malware that employs obfuscation techniques and divides malicious activities among multiple agents, making it difficult to detect evasive malware effectively.
Innovation Solution
A computer system and method that organizes monitored executable software entities into groups based on inter-entity relations such as filiation and code injection, using a scoring engine to determine malware presence by analyzing actions within these groups, allowing for the detection of collective malicious behavior across multiple entities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If malware divides malicious activities among multiple agents, then detection difficulty increases, but system complexity for evasion increases
Solution Approach 1:
The system segments malware detection by organizing software entities into hierarchical groups (process groups, thread groups, entity groups) based on inter-entity relations. This segmentation allows the system to track malicious activities across multiple agents by grouping them according to their relationships, making distributed malware behaviors detectable through group-level analysis rather than individual entity monitoring
Solution Approach 2:
The system merges information from multiple entities into group-level scores by combining individual entity scores within each group. The scoring engine aggregates behaviors across related entities (processes, threads, code objects) to produce a collective malware indication, effectively combining scattered malicious signals into a unified detection mechanism that identifies coordinated attacks
2Measurement precision
If obfuscation techniques are used by malware, then detection precision decreases, but malware adaptability increases
Solution Approach 1:
The system performs preliminary organization of software entities into groups based on inter-entity relations before malware execution completes its malicious payload. By pre-establishing the hierarchical structure of processes, threads, and code objects, the system is positioned to immediately correlate obfuscated behaviors with their source entities, improving detection precision against adaptive malware that changes its behavior patterns
Solution Approach 2:
The scoring engine implements feedback mechanisms by continuously updating entity scores and group scores based on observed behaviors. When an entity exhibits suspicious activity, its score is updated and propagated to parent groups, creating a feedback loop that refines detection precision. This adaptive scoring system adjusts to new malware patterns by learning from observed behaviors and updating threat assessments in real-time
Data Source
AI summary
Described systems and methods allow protecting a computer system from malicious software. In some embodiments, a security application organizes a set of monitored executable entities (e.g., processes) into a plurality of groups, wherein members of a group are related by filiation and/or code injection. The security application may further associate a malice-indicative entity score with each monitored entity, and a malice-indicative group score with each entity group. Group scores may be incremented when a member of the respective group performs certain actions. Thus, even though actions performed by individual members may not be malware-indicative per se, the respective group score may capture collective malicious behavior and trigger malware detection.